none
Reading Windows Update Datastore.edb File

    Question

  • Hello,

    While searching for ways to monitor Windows Update on client machines, I ran across information indicating that Windows stores most of its Windows Update information inside of the Datastore.edb file found inside C:\Windows\SoftwareDistribution\Datastore.

    1.) Does anyone know of a Microsoft-sanctioned way to access this database? The information I am looking for does not seem to be available with the Windows Update Agent API (unless I somehow missed it). I would like to know what folder under SoftwareDistribution\Download specific updates are downloaded to. I would also like to know what executables will be launched to start the installation.

    2.) Does anyone know of a generic EDB database viewer? I was unable to find one that could read the Datastore.edb file.

    3.) Does anyone know of source code for accessing/querying an EDB database?


    Thank you for any help you can provide.
    Saturday, January 29, 2011 5:42 PM

Answers

  • I was hoping to find a way to associate individual files in C:\Windows\SoftwareDistribution\Download with their associated updates. That would allow me to know what binary files were actually responsible for each update.


    Ahhh.... well, that can actually be done without the need to access the WUAgent datastore!

    First thing I'll mention is that the files in the Datastore folder should be automatically maintained by the WUAgent. They should be purged 10 days after successful installation. If all downloaded updates have been installed to the machine, you can safely purge anything older than 10 days.

    The filenames in the folder that are 40-characters long, are the SHA-1 hashed filename of the update file itself, and they can be correlated with the list of filenames for an update available from the Updates View, on the File Information menu option of the context menu for the update. I would suggest ordering both the filelist and the update list by date, and you should be able to traverse the update list of updates applicable to that system and correlate the updates spanning the past 10 days.

    The folders, generally, are the work folders created by the installers themselves, and should be cleaned up by the installers.

    Anything older than 10 days is either an orphaned update, or something that's failing installation.


    Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
    Principal/CTO, Onsite Technology Solutions, Houston, Texas
    Microsoft MVP - Software Distribution (2005-2011)
    My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
    My Blog: http://onsitechsolutions.spaces.live.com
    Monday, March 14, 2011 1:58 PM
    Moderator

All replies

  • Given that the fundamental question seems to be about "monitoring Windows Update on client machines", perhaps the proper starting point is to better describe what you mean by "monitoring Windows Update", and what your ultimate objectives might be.

    Since you've posted in a **WSUS** forum, I'll assume you're aware of WSUS as a product, which is how one would typically "monitor Windows Update" in an organizational environment.

    To your questions:

    1. There is no Microsoft-sanctioned access to that database. The database is used internally by the WUAgent to support the activities of the WUAgent. However, it should be noted that the database is a standard JET database, so just about any JET-designed tools should be workable. Previous admins have had some success using the Exchange DB Repair tools on the DATASTORE.EDB.

    2. A 'generic' EDB database viewer? I'd start with Microsoft Access.

    3. Source code??? If you mean the database schema... No. The schema is not publicly documented.


    Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
    Principal/CTO, Onsite Technology Solutions, Houston, Texas
    Microsoft MVP - Software Distribution (2005-2011)
    My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
    My Blog: http://onsitechsolutions.spaces.live.com
    Monday, January 31, 2011 9:28 PM
    Moderator
  • My apologies Lawrence. I got busy and did not follow up on this as I should have. Thank you for the information you provided. I was hoping to find a way to associate individual files in C:\Windows\SoftwareDistribution\Download with their associated updates. That would allow me to know what binary files were actually responsible for each update.

    Thursday, March 10, 2011 11:40 PM
  • I was hoping to find a way to associate individual files in C:\Windows\SoftwareDistribution\Download with their associated updates. That would allow me to know what binary files were actually responsible for each update.


    Ahhh.... well, that can actually be done without the need to access the WUAgent datastore!

    First thing I'll mention is that the files in the Datastore folder should be automatically maintained by the WUAgent. They should be purged 10 days after successful installation. If all downloaded updates have been installed to the machine, you can safely purge anything older than 10 days.

    The filenames in the folder that are 40-characters long, are the SHA-1 hashed filename of the update file itself, and they can be correlated with the list of filenames for an update available from the Updates View, on the File Information menu option of the context menu for the update. I would suggest ordering both the filelist and the update list by date, and you should be able to traverse the update list of updates applicable to that system and correlate the updates spanning the past 10 days.

    The folders, generally, are the work folders created by the installers themselves, and should be cleaned up by the installers.

    Anything older than 10 days is either an orphaned update, or something that's failing installation.


    Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
    Principal/CTO, Onsite Technology Solutions, Houston, Texas
    Microsoft MVP - Software Distribution (2005-2011)
    My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
    My Blog: http://onsitechsolutions.spaces.live.com
    Monday, March 14, 2011 1:58 PM
    Moderator
  • Hello Mercury529,

    In the C:\Windows\SoftwareDistribution\Download directory, you can find 40-char length files name that correspond to the 40 final chars of IUpdateDownloadContent::DownloadUrl property.

    For a complete cleaning (clearing also the whole update history):

    1. net stop wuauserv
    2. net stop bits
    3. delete all files inside the C:\Windows\SoftwareDistribution\Download directory 
    4. delete the DataStore.edb into C:\Windows\SoftwareDistribution\DataStore
    5. net start bits
    6. net start wuauserv

    and, take a look to my free utility to manage your windows updates: www.portableupdate.com

    Regards,

    gigirex



    Monday, July 23, 2012 10:25 AM
  • Hello,

    While searching for ways to monitor Windows Update on client machines, I ran across information indicating that Windows stores most of its Windows Update information inside of the Datastore.edb file found inside C:\Windows\SoftwareDistribution\Datastore.

    1.) Does anyone know of a Microsoft-sanctioned way to access this database? The information I am looking for does not seem to be available with the Windows Update Agent API (unless I somehow missed it). I would like to know what folder under SoftwareDistribution\Download specific updates are downloaded to. I would also like to know what executables will be launched to start the installation.

    2.) Does anyone know of a generic EDB database viewer? I was unable to find one that could read the Datastore.edb file.

    3.) Does anyone know of source code for accessing/querying an EDB database?


    Thank you for any help you can provide.

    Hello, 

    I was searching for a way to maybe import the datastore.edb file to an SQL Server database when I came across your question. There is a non-Microsoft sanctioned utility here that works on Windows 7 x64. The utility will allow you to export to HTML file


    Saturday, April 20, 2013 2:46 PM